WSS TLS handshake error

Could you please clarify that? It doesn’t seem to mess with the implicit redirects from auto_https if that is what you meant?

Below is what I used to verify, everything is bundled into a single compose.yaml file you can copy/paste, then just run the CLI commands shown at the end :slight_smile:

# For the separate container to reference by name:
networks:
  default:
    name: custom-network

services:
  reverse-proxy:
    image: caddy:2.8
    container_name: caddy
    # Normally this would be `volumes`, but `configs` embeds config for a simple copy/paste `compose.yaml` example
    configs:
      - source: caddy-config
        target: /etc/caddy/Caddyfile
    # Support for requests from the Docker host like: `https://example.localhost`
    ports:
      - "80:80"
      - "443:443"
    # Containers on this network will resolve these aliases to the IP of this container:
    networks:
      default:
        aliases:
          - example.test

configs:
  caddy-config:
    content: |
      {
        local_certs
        # Docker Compose ENV interpolation feature to toggle auto_https:
        ${AUTO_HTTPS:-}
      }

      :80 {
        respond "Hello from port 80"
      }

      # `auto_https disable_redirects` would need require this for HTTP + HTTPS access:
      #http://example.test, https://example.test {
      example.test, example.localhost {
        respond "Hello from {scheme}://{host}"
      }
$ docker compose up --force-recreate

# Run a separate container on the same network to curl from and leverage container DNS
$ docker run --rm -it --network custom-network fedora

# HTTP => HTTPS redirect works:
$ curl -L --insecure http://example.test
Hello from https://example.test

# Caddy container also reachable via container_name:
$ curl -L --insecure http://caddy
Hello from port 80
# Repeat but this time with implicit redirects disabled:
$ AUTO_HTTPS='auto_https disable_redirects' docker compose up --force-recreate
$ docker run --rm -it --network custom-network fedora

# HTTP => HTTPS redirect disabled as expected:
$ curl -L --insecure http://example.test
Hello from port 80

# HTTPS still available directly as expected:
$ curl --insecure https://example.test
Hello from https://example.test